Starting Light: The One-Sentence Mission

• In one sentence, what is the core mission you need this program to accomplish this fiscal year?
• Which statutory or reporting mandate makes this work non-optional for your team? Options: OPEN Government Data Act, GPRAMA / Performance Reporting, Congressional Reporting Request, State-level federal reporting, Other
• What is the fiscal-year deadline or milestone we must hit to be considered successful? Options: End of current fiscal year, Quarterly milestone (specify), Rolling delivery within fiscal year, No firm deadline yet, Other
• Thinking about stakeholders at a high level, who is on the shortlist of people we should involve from day one?
• Briefly describe any prior attempts or vendors you've engaged on this problem and what did/didn't work?

Who Really Signs the Check? (And Who’s Listening)

• If this project succeeds, whose career or program outcomes will visibly improve — and whose profile is most at risk if it fails? Options: Chief Data Officer, Agency CIO, Program Director, Budget/Finance Officer, Legal/OGC, Congressional Liaison, Other
• Please identify the primary decision-maker, the approver, and two top influencers by name/role (or write 'TBD'):
• Which of the following best describes each stakeholder’s formal decision authority for procurement and acceptance? Options: Approver (final signatory), Budget approver only, Technical approver/influencer, End-user/implementation owner, Advisory/influencer, Unknown
• How do your stakeholders prefer to be briefed about risk and progress? Options: Formal monthly brief, Weekly tactical sync, Email updates, Ad hoc executive briefings, Dashboard access only
• Who on the team is authorized to approve required security or privacy documentation (e.g., POA&Ms, Privacy Impact Assessments)? Options: CISO/ISSO, OCIO Security Lead, Privacy Officer, Program Manager, Contracting Officer, Unknown

What Keeps You Awake at 3AM?

• Which single compliance failure would be most damaging to your program’s credibility — a FedRAMP gap, FISMA deficiency, a Privacy Act breach, or something else? Options: FedRAMP authorization gap, FISMA audit finding, Privacy Act violation, Interagency data-sharing legal issue, Data breach/exfiltration, Loss of funding/Congressional scrutiny, Other
• What recent audit findings, POA&Ms, or close calls should we know about (please summarize dates, severity, and current status)?
• Which security or compliance controls do you currently lack or consider fragile? Options: Identity & access management, Encryption in transit/at rest, Centralized logging & SIEM, Automated FISMA evidence collection, Data minimization/PII controls, Formal interagency MOUs, Other
• How does the possibility of an audit or Congressional question affect your willingness to accelerate vs. delay implementation? Options: Accelerate to show progress, Delay until more controls are in place, Mix: quick wins then hardening, Unsure
• Describe how compliance risk lands emotionally in your leadership team—frustration, resignation, fear, or urgency? Options: High urgency/anxiety, Frustration but manageable, Resigned acceptance, Optimistic/confident

Are We Just Shuffling Spreadsheets? (Reality of Your Data Landscape)

• How would you describe where the mission-critical data currently lives? Options: On-prem relational DBs (Oracle/SQL), Mainframes / legacy flat files, Excel/Shared drives, SharePoint / Document stores, Cloud SaaS (vendor-owned), Other
• Which of these describes your access control posture across those sources? Options: Role-based access enforced, Individual accounts with limited audit, Shared credentials or ad-hoc access, No formal access controls, Mixed/varies by system
• Do you have auditable data lineage and metadata for the datasets we'll need for reporting? Options: Complete lineage & catalog, Partial lineage with gaps, Minimal metadata only, None — needs building
• How fresh do the data need to be for your reporting use cases? Options: Near real-time, Daily, Weekly, Monthly, Ad-hoc
• Which internal skill gaps hinder delivery the most? Options: Data engineering, Cloud/GovCloud ops, Security/FedRAMP expertise, Data governance & stewardship, Analytics/dashboarding, Contract management
• Tell us a short story: a recent task that took far longer than it should because of data fragmentation—what happened and why?

What Would Success Look Like in the Hearing Room?

• If you were in front of the agency head or Congress, what three measurable outcomes would convince them this program succeeded? Options: On-time GPRAMA submission, OPEN Data Act compliance achieved, Dashboards available for briefing, Reduction in manual hours, Closure of FISMA deficiencies, Improved data quality scores
• For each chosen outcome above, please provide the target metric or threshold (e.g., data quality score > 95%, reports delivered by X date):
• Which stakeholders must formally sign off on acceptance criteria for those outcomes? Options: Program Manager, CIO/OCIO, CISO/ISSO, Data Steward, Budget/Finance, Legal/Privacy
• How will success be measured operationally after handoff to ops (SLA, uptime, refresh cadence, runbook maturity)? Options: SLA metrics, Scheduled refresh cadence, Runbooks & playbooks, Monthly ops reviews, Shared backlog for enhancements
• What political or fiscal constraints could force scope down even if the technical work is proven?

Unmasking the Hidden Dependencies (The Things That Break Timelines)

• Which external approvals, partners, or third parties could silently derail your timeline if they don't sign off as planned? Options: OGC/Legal, CIO Security/ACSC, Contracting/Procurement, FedRAMP PMO / CSP, Interagency data partners, State/local partners, Third-party vendor integrations
• Which environment and authorization baselines are required before we can operate (choose all that apply)? Options: FedRAMP Moderate, FedRAMP High, FISMA documented controls, GovCloud AWS/Azure, On-prem only, Hybrid
• Do standing interagency data-sharing agreements (MOUs, DTAs) already exist for the required data exchanges? Options: Yes — fully executed, In progress, Not started, Not applicable
• What contracting vehicle would you prefer or require for fast procurement? Options: GSA IT Schedule 70, Agency BPA, IDIQ / Task Order, Direct award using other contract, TBD
• Who needs to be in the escalation path if a technical or legal blocker appears mid-sprint (names/roles)?

Let's Make a Practical Commitment (Smallest Test That Proves Value)

• What is the smallest, time-boxed deliverable that would demonstrate value within 60 days? Options: 60-day data maturity assessment, Pilot ingestion + dashboard for one dataset, FedRAMP readiness gap analysis, Proof-of-concept API integration, Other
• Do you have budget authority or earmarked funds for a 60–90 day pilot? If so, which band fits your current expectation? Options: <$250k, $250k–$500k, $500k–$1M, >$1M, No budget yet / TBD
• Who is authorized to approve a statement of work or task order for the pilot? Options: Contracting Officer, Program Manager, CIO/OCIO, Budget/Finance, Other
• What cadence for governance and progress reviews would make you comfortable (pick one)? Options: Weekly engineering sync, Bi-weekly steering committee, Monthly executive review, Ad hoc as needed
• If we had agreement on a pilot, what are the top three roadblocks you would want us to resolve before kickoff?

Opening: Tell Us About Today's Reality

• What is the single most important data deliverable you must produce this fiscal year (e.g., OPEN Data Act dataset, GPRAMA metrics, congressional packet)?
• Which office owns that deliverable? Options: Chief Data Officer (CDO), CIO/IT, Program Office/PM, Compliance/Oversight, Other
• Roughly how many distinct source systems feed the data you need for that deliverable? Options: 1–5, 6–20, 21–50, 51–200, 200+
• How would you describe the emotional impact of your current data situation on leaders—frustration, disbelief, resigned acceptance, or cautious optimism? Options: Frustration, Disbelief, Resigned acceptance, Cautious optimism, Other
• If you could change one practical thing about your current environment right now, what would it be?

Is Your Legacy Stack Quietly Blocking Delivery?

• Which legacy platforms and data stores currently contain the mission data we must integrate? Options: Oracle, Mainframe (COBOL/flat files), SQL Server, PostgreSQL, SharePoint/Network drives, Document stores (e.g., Documentum), SaaS systems (e.g., ServiceNow), Custom on-prem apps, Other
• For the primary systems you selected, which of these best describes how accessible the data is today? Options: Accessible via APIs, Direct DB connections allowed, Manual extracts only (spreadsheets), Exported nightly files, Not accessible without manual approval, Unknown
• Which locations host that data (choose all that apply)? Options: On-prem datacenter, GovCloud (AWS/Azure/GCP), Commercial cloud, Local workstations, Physical media (tape/drives), Third-party contractor environment, Unknown
• Tell us about typical extraction frequency for the datasets you rely on (daily, weekly, ad-hoc, etc.) and where that cadence breaks down.
• Have prior integration attempts hit a specific technical blocker (e.g., incompatible schemas, lack of credentials, unsupported encryption), and how long has that been unresolved?

Who Really Touches Your Data—and With What Permissions?

• Who currently has access to the raw source data needed for reporting (internal roles and external partners)? Options: Program staff, CDO/analytics team, Agency contractors, Other agencies, Third‑party vendors, Public/No access
• Which identity and access methods control that access today? Options: LDAP/AD, SAML/OAuth with IdP, Local DB accounts, Manual spreadsheet lists, VPN-only access, No formal access controls
• How long does it take on average to provision or revoke access to a dataset or system? Options: Same day, 1–3 business days, 1–2 weeks, More than 2 weeks, Unknown
• Are there role-based access matrices or documented data owners per dataset? If yes, share gaps or inconsistencies you've noticed. Options: Yes — complete and maintained, Partial — some datasets only, No — informal/unknown, Plan to create one
• How comfortable are stewards with granting the minimum access needed for automated reporting vs. sharing full extracts? Options: Very comfortable, Somewhat comfortable, Hesitant, Refuse full automation

What Audit Alarms Keep You Up at Night?

• When auditors come asking, which open findings or controls do you expect they'll focus on first? Options: FISMA controls, FedRAMP gaps, Privacy Act/PII handling, Change management, Access controls/audit logs, Data integrity/lineage
• How many open audit findings or corrective actions relate directly to data handling or reporting? Options: None, 1–3, 4–10, 11–25, 25+
• Which of the following compliance artifacts do you currently have automated (e.g., evidence generation, control mapping, continuous monitoring)? Options: Automated evidence collection, Control mapping to systems, Continuous monitoring dashboards, Manual evidence only, None
• How quickly could you produce a defensible audit package for your primary dataset today? Options: Same day, 1–3 days, 1–2 weeks, Longer than a month, Cannot produce
• Tell us about a recent compliance surprise—what happened, how did it surface, and what impact did it have?

Where Does Your Data Quality Break Down?

• If we traced a sample record from source to report, where do you suspect we’d lose fidelity or context first? Options: Schema mismatches, Manual transformation errors, Missing metadata, Inconsistent identifiers, Stale extracts, Other
• Do you currently measure data quality with scores, and if so, which dimensions are tracked? Options: Completeness, Accuracy, Timeliness, Uniqueness, Consistency, No formal scoring
• How visible is lineage for your key data flows—could we diagram source→transform→report in under an hour? Options: Yes, fully documented, Partially documented, Fragmented across teams, No documentation
• When quality issues appear, what is your typical remediation path and average time-to-fix? Options: Automated alert→fix in hours, Manual triage→days, Escalates to weeks, Unresolved/backlog
• Give an example of a dataset where quality issues changed a program decision—what was the consequence?

Who’s Doing the Heavy Lifting—And What’s Missing?

• Which teams or roles are currently responsible for building and maintaining data pipelines? Options: In-house data engineers, Shared IT/devops, Program analysts, Contractors/vendors, No dedicated team
• Do those individuals have FedRAMP/FISMA experience and the necessary clearances to work in government clouds? Options: Yes — team has experience & clearances, Some members do, No — we rely on contractors, Unknown
• Where are the biggest skill gaps that slow progress (cloud architecture, API development, data modeling, security engineering, compliance automation)? Options: Cloud architecture, API development, Data modeling/ETL, Security/FISMA, Data governance/metadata, Other
• How much of your delivery relies on contractors or one-off scripts that only one person understands? Options: Mostly contractors, Mix of staff & contractors, Mostly staff, Critical single-person dependencies exist
• What would give your team confidence they could sustain a modern pipeline after vendor transition?

If the Deadline Were Tomorrow, What Would Break?

• What are the non-negotiable dates (fiscal deadlines, reporting windows, hearings) that drive your timeline? Options: End of fiscal year, Quarterly GPRAMA deadlines, Congressional hearing dates, Grant reporting deadlines, Other
• Which dependencies most threaten meeting those dates (data latency, approvals, environment provisioning, staffing)? Options: Data latency, Security approvals, Environment setup, Interagency agreements, Staff availability
• If we had to deliver a minimal, auditable dataset for your deadline, which compromises would you accept and which are non-starters?
• What internal approval cycle (weeks to months) must we plan around to get sign-off on scope, security, and go-live? Options: Days, 1–2 weeks, 3–6 weeks, 2+ months
• How will funding constraints this fiscal year affect delivery (firm budget, potential reprogramming, or uncertain funding)? Options: Firm budget, Possible reprogramming, Uncertain/contingent, Grant-funded

How Do You Want the World to See Your Data?

• Which levels of data sharing are permitted for your mission datasets (internal only, interagency, public release) under current policy? Options: Internal only, Interagency with agreements, Public release allowed, Case-by-case/Privacy Act restrictions
• What privacy or legal constraints (Privacy Act, FOIA, specific statutes) limit how you can transform or release the data? Options: Privacy Act, PII/PHI restrictions, Statutory non-disclosure, Paperwork Reduction Act limits, None/unknown
• Do you have established de‑identification or aggregation rules for public datasets, and who owns those policies? Options: Yes — documented and owned, Partial rules, No rules documented, Owned by legal/compliance
• What would make interagency sharing faster for you—pre-built MOU templates, standardized APIs, or a trusted FedRAMP-hosted exchange? Options: Pre-built MOU templates, Standardized APIs, FedRAMP-hosted exchange, Other
• How would you feel if certain datasets could be published publicly after automated redaction—excited, anxious, skeptical, or indifferent? Options: Excited, Anxious, Skeptical, Indifferent

If We Had 60–90 Days to Show Progress, What Would You Expect?

• What are three measurable interim milestones that would convince leadership the engagement is on track?
• Which environments and credentials must be provisioned before engineering can begin (e.g., GovCloud account, service accounts, data extracts)? Options: GovCloud account, Service accounts/API keys, S3/secure buckets, VPN and bastion hosts, None/unknown
• What acceptance criteria would you require for a 60‑day proof-of-concept (data lineage visibility, automated ingestion, basic dashboard)? Options: Lineage visibility, Automated ingestion, Baseline data quality scores, Preliminary dashboard, Compliance artifacts
• Who must be in the room for weekly checkpoints and who has authority for scope decisions? Options: CDO, CIO, Program lead, Security officer/ISSO, Contracting officer, Other
• What risks would cause you to pause or stop a sprint and who gets to make that call?

Let's Capture Quick Facts for Prioritization

• Which three data domains should we prioritize (e.g., finance, program performance, case records, geospatial)? Options: Finance & budget, Program performance, Case/beneficiary records, Geospatial, Operational logs, Other
• Rank the top implementation constraints we should prioritize for mitigation (pick up to 3). Options: Security/FISMA controls, Data access approvals, Staff skills, Environment provisioning, Interagency agreements, Budget/funding
• Which of these quick wins would be most valuable to you in month 1? Options: Automated nightly ingest of a critical dataset, Data lineage diagrams for a key pipeline, Baseline data quality dashboard, Access provisioning playbook, Compliance evidence snapshot
• Is there an existing architecture diagram, data inventory, or audit report you can share to accelerate discovery? Options: Architecture diagram, Data inventory, Recent audit report, None available, Will provide on request
• Finally, who should receive our formal discovery deliverable and who will be the primary point of contact?

Before We Flip the Switch

• What is the primary driver for moving this project into deployment now? Options: Congressional reporting deadline, Fiscal-year deliverable, Audit remediation (FISMA), Interagency data-sharing need, Operational necessity, Other
• Tell us about the last time your team shipped a system into production — what went well and what surprised you?
• Which deployment window is your agency prioritizing? Options: Before the end of this quarter, Before fiscal-year end, After current procurement task order, Timing is flexible, Other
• Are there immovable compliance or reporting dates that will force a go/no‑go decision? Options: Yes: Congressional/GPRAMA deadline, Yes: FISMA audit date, Yes: Interagency data agreement deadline, No fixed date, Unsure
• If this deployment succeeds, what will leadership point to first as evidence of success?

What Would Break Us If We Waited?

• If deployment is delayed, what single risk keeps you awake at night?
• What downstream impacts would a delayed deployment cause (e.g., missed reporting, lost funding, audit failure)? Options: Missed congressional reporting, Budgetary risk, Extended audit findings, Operational inefficiency, Contractual penalties, Other
• Which interagency or external dependency is most likely to cause schedule slippage? Options: External data provider, Partner agency interface, Vendor schedule, Security authorization (ATO), Cloud provisioning, Other
• How long can the program sustain a delay before mission impact becomes irreversible? Options: < 2 weeks, 2–6 weeks, 6–12 weeks, Several months, Unsure
• Have past delays revealed a root cause we should address now? If so, what was it?

Who Needs to Be in the Room (and Who's Missing)?

• If one person could unilaterally stop the deployment, who would that be and why?
• Which stakeholders must approve provisioning, data access, and security artifacts for go/no‑go? Options: CDO, CIO/Authorizing Official, Information System Security Officer (ISSO), Privacy Officer, Program Manager, Other
• What clearance levels and background checks will engineers and reviewers need? Options: Public Trust, Secret, Top Secret, TS/SCI, No special clearance, Unsure
• Are the named approvers regularly available during the proposed sprint schedule? Options: Yes — dedicated availability, Partially available — limited windows, Sporadic availability, Unavailable until later date
• Who is the alternate decision owner if a primary approver is absent? Provide name and role.

Do We Actually Have the Data Access We Need?

• If our team arrived tomorrow with integrations ready but no dataset access, what would we be unable to do?
• Please list the discrete data sources we will need to onboard during deployment (system name and owner).
• How is access to each source provisioned today? Options: Direct DB connection, APIs (internal), APIs (external partner), File transfer/flat files, Manual exports/spreadsheets, Other
• What sensitivity classifications apply to those sources (e.g., PII, SBU, Classified)? Options: Public, SBU/Confidential, PII, Privacy Act, High Risk/Critical, Classified
• Who is the data steward for each source and how quickly can they issue access approvals? Options: Within 48 hours, 1–2 weeks, Several weeks, Longer / unknown

Are the Environments Real or Paper Promises?

• Which environment is most likely to fail a realistic load or security test and why?
• Which of the following environments are provisioned and ready for use? Options: Development (Sandbox), Integration/Test, Staging/Pre-Prod, Production, Disaster Recovery, Not provisioned
• For each environment you marked, what is the provisioning status? Options: Provisioned & smoke-tested, Provisioned, not tested, Requested, awaiting approval, Not requested
• Are GovCloud regions, network peering, VPN/Direct Connect, and VPC routing configured and validated? Options: All configured & validated, Partially configured, Requested but not configured, Not applicable / Unsure
• Who owns environment hardening and patching (agency, vendor, or shared) and what cadence is expected? Options: Agency-owned — agency cadence, Vendor-owned — vendor cadence, Shared — defined schedule, Undetermined
• If any environment is not ready, what is the single blocking action preventing provisioning?

Can We Prove Compliance Without a Paper Stack?

• If auditors requested artifacts tomorrow, which controls could we prove automatically and which would require manual effort? Options: Automated evidence available, Mostly manual evidence, No evidence available, Partially automated
• Which families of FISMA controls are in scope for this deployment (select all that apply)? Options: Access Control (AC), Audit & Accountability (AU), Configuration Management (CM), Identification & Authentication (IA), Incident Response (IR), System & Communications Protection (SC), Risk Assessment (RA)
• Do you have baseline system security documentation (SSP), plan of actions (POA&M), and continuous monitoring plan that map to the environments? Options: Yes — current and mapped, Yes — partial, No — need to create, Unsure
• Which compliance artifacts can we generate during deployment (e.g., automated logs, evidence of RBAC enforcement, change history)? Options: Audit logs, Role-based access evidence, Configuration snapshots, Data access records, Encryption & key management proofs, Other
• Who is responsible for final ATO/ATO‑like signoff and what is their expected timeline?

How Will Integrations Behave on Day One?

• Which external interface is most likely to fail under real conditions, and what makes it fragile?
• List the external systems, partner APIs, or legacy endpoints we must integrate with during the deployment.
• What authentication and authorization mechanisms do these interfaces require? Options: OAuth2 / JWT, Mutual TLS, API keys, SAML, Host-based ACLs, Database credentials, Other
• Are there sandboxes or test accounts available for each partner integration? Options: Yes — full sandbox, Limited test access, No — only production, Unsure
• What SLAs, throughput, or latency expectations should integrations meet in production? Options: <100ms, <500ms, <1s, <5s, Batch/Non-real time
• Who is the named contact at each partner system for escalation and access issues?

If Things Go Wrong, Do We Know What to Do?

• When the service degrades on day one, what exact threshold should trigger an operational page? Options: Data pipeline failure, Data quality below threshold, Authorization or outage in an upstream system, Critical job crash, Other
• Do you have an incident response playbook that covers deployment-specific failure modes (integration loss, data corruption, permission errors)? Options: Comprehensive playbook exists, Playbook exists but incomplete, No playbook, Unsure
• What rollback or mitigation strategies are acceptable to the program (e.g., pause ingestion, route to backup, roll forward with patch)? Options: Rollback to previous snapshot, Pause and queue, Use fallback feed, Hotfix and roll forward, Other
• Where do we get forensic logs and tracing when something fails — and who has access to them? Options: Centralized logging (SIEM), Host-level logs only, Partner systems provide logs, Logs are limited / restricted
• How should we communicate incidents to stakeholders, and who must be notified immediately?

What Will 'Ready' Actually Look Like to Your Leadership?

• Would leadership accept a phased readiness approach (minimal viable pipelines first) or insist on full feature parity at initial deploy? Options: Phased / MVP first, Full feature parity required, Hybrid — critical features first, Undecided
• List the top 3 acceptance criteria that must be met before you consider the deployment successful.
• What quantitative data quality thresholds must be met (e.g., completeness, accuracy, freshness)? Options: >99% completeness, >95% accuracy, Daily freshness, Weekly freshness, Other
• What does a successful transition to operations look like (roles, SLAs, shared backlog, training)? Options: Agency-run operations, Vendor-run operations, Joint ops model, Short-term vendor support then handoff
• Which metrics should we track for the first 90 days post-deploy to demonstrate mission value? Options: Timeliness of reports, Number of successful ingestions, Data quality scores, User adoption metrics, Incident count and MTTR, Other
• Who will own the ongoing backlog of enhancements and who is their backup?

Start Here — Tell Us About Your Mission

• Who are you (name, title) and which program or mission does this data effort support?
• Which role best describes your primary relationship to this project? Options: Chief Data Officer, CIO/IT Leadership, Program/Operations Director, Security/InfoSec Officer, Procurement/Contracting Officer, Analytics Lead/Scientist, Other
• What is the governing legal or reporting mandate driving urgency for this work? Options: OPEN Government Data Act, GPRAMA/Performance Reporting, Congressional Reporting Request, FISMA Compliance, Privacy Act / FOIA constraints, Other
• When must the first meaningful deliverable be in place (fiscal quarter or date)? Options: Within 30 days, 30–60 days, 60–120 days, By end of current fiscal year, No hard deadline
• Which procurement vehicle do you expect to use for this engagement? Options: GSA IT Schedule/BPA, Agency-specific BPA/IDIQ, Government-Wide Acquisition Contract (GWAC), Direct award/sole source, Unsure / Need guidance

If We Did Nothing, What Would Break First?

• What critical report, audit finding, or congressional ask would fail if no improvements were made this fiscal year?
• How frequently do you face external reviews or audits that depend on this data? Options: Monthly, Quarterly, Annually, Ad-hoc / as requested
• What specific audit findings or compliance gaps are on your remediation list right now?
• If those failures occurred, what would be the likely consequence for the program (operational delay, funding risk, political scrutiny, other)? Options: Operational disruption, Loss of funding, Reputational/political risk, No immediate consequence, Other
• Who in leadership feels the heat most when reporting or compliance slips? Options: CDO, CIO, Program Director, Chief Counsel/Legal, Deputy Secretary/Executive, Other

Where Your Data Actually Lives (and Who Guards the Keys)

• How many distinct source systems, databases, or file repositories are typically involved in producing a single performance metric? Options: 1–3, 4–7, 8–15, More than 15, Unknown
• What types of systems hold that data? (select all that apply) Options: Mainframe / legacy flat files, Oracle / RDBMS, Federal SaaS applications, Spreadsheets / manual records, Document repositories / unstructured stores, Geospatial systems, Other
• Are formal Data Owner or System Owner assignments documented for those sources today? Options: Yes, fully documented, Partially documented, Informally known, No / unknown
• What level of data sensitivity and classification affects these sources? Options: Unclassified/public, Sensitive but unclassified (SBU), Controlled Unclassified Information (CUI), Privacy Act / Personally Identifiable Information (PII), Classified
• Describe the current process for getting access to a critical source (who approves, how long, blockers).

What's Slowing Your Team Down—Beyond Tech

• What single human or process issue frustrates you most when attempting to produce reliable analytics?
• Which staffing gaps matter most right now? Options: Data engineers, Cloud architects, Security/compliance analysts, Data stewards / catalog managers, BI/dashboard developers, Other
• How long does it typically take your team to onboard a new data source into a reportable pipeline? Options: <2 weeks, 2–6 weeks, 6–12 weeks, 12+ weeks, Varies widely
• How often do manual spreadsheets or ad-hoc data pulls still form the basis of your official reporting? Options: Always, Often, Occasionally, Rarely, Never
• When delays happen, what emotions or political reactions tend to surface in leadership or partner agencies?

If You Could Snap Your Fingers

• If you could guarantee one measurable outcome from this engagement by year-end, what would it be?
• Which of these outcomes would be highest priority for you? Options: Publish OPEN Data Act datasets, Deliver GPRAMA performance metrics, Close FISMA audit findings, Automate congressional reporting, Eliminate manual spreadsheet reporting, Other
• For your chosen priority, what concrete metric would prove success (e.g., x% reduction in manual effort, y days to report)?
• What constraints are non-negotiable for delivering that outcome (select all that apply)? Options: Must be FedRAMP-authorized environment, Complete within fiscal year, Operate within existing budget, No increase in headcount, Privacy Act protections enforced, Other
• How would you and your leadership celebrate or communicate that success internally and to stakeholders?

What Would Count as Risky to Your Leadership?

• What single risk would make senior leadership pull the plug on this initiative?
• Which of these concerns are most likely to stall approval? Options: Security/compliance gaps, Unclear ROI/cost overrun, Schedule slips, Interagency data-sharing objections, Vendor past performance, Other
• How tolerant is leadership of iterative delivery with early pilots versus waiting for a full end-state? Options: High tolerance — prefer pilots, Moderate — need some milestones, Low — want complete solution before signoff, Undecided
• What mitigation approach would make leadership comfortable (e.g., limited-scope pilot, escrow data access, formal SLA)?
• Who must explicitly sign off on risk mitigations before work begins? Options: CDO, CIO, Chief Information Security Officer (CISO), Program Director, Legal/Privacy Office, Other

How Do You Want to See the Solution?

• Would you rather see a working pilot within 60 days or a full architecture and data governance plan first? Options: Working pilot in 60 days, Architecture & governance plan first, Both in parallel, Undecided — need guidance
• What deployment environment is required or preferred for your agency? Options: FedRAMP High GovCloud (AWS), FedRAMP Moderate GovCloud, Agency on-premises, Hybrid (GovCloud + on-prem), Unsure / need recommendation
• Which acceptance criteria will be non-negotiable for sign-off (select all that apply)? Options: Data lineage documented, Automated data quality scores, RBAC aligned with agency roles, FISMA control evidence automated, Successful pilot ingest of X sources, Other
• Who will be the primary approver(s) for acceptance testing and why?
• Are there internal policies or legacy constraints we must honor in the solution design (e.g., prohibited cloud regions, data retention rules)?

Who Needs to Be On the Bus (and Who Might Say No)?

• Which stakeholder could single-handedly block progress if they feel excluded or unheard? Options: CISO/CISO office, Legal/Privacy, Program Director, OMB or centralized authority, External partner agency, Other
• List the core stakeholders who must be engaged for design, security, and acceptance (names/roles).
• How do these stakeholders currently define success for their teams (select all that apply)? Options: Timely reporting, Audit readiness, Data-driven decisions, Reduced manual effort, Cost containment, Other
• Who should be the day-to-day agency owner working with our engineering team? Options: Program Manager, Data Steward, IT System Owner, Other
• What political or interagency sensitivities should we be aware of when approaching partners?

The Reality of Access and Clearance

• Is there any required clearance, enclave, or special environment that will block engineers from accessing key data? Options: Yes — requires special clearance, Yes — requires enclave access but no clearance, No — data accessible with standard PIV, Unknown
• Which environments are currently provisioned and ready for development, testing, and production? Options: Dev available, Test/Staging available, Prod available, None available, Some partially provisioned
• What FISMA control status describes your systems today? Options: Up-to-date POA&M cleared, POA&M present with scheduled remediation, Significant open findings, Not assessed / unknown
• How long does it typically take to provision the necessary accounts, roles, and interfaces for a new vendor integration? Options: <2 weeks, 2–6 weeks, 6–12 weeks, 12+ weeks, Varies widely
• Describe any recent experiences provisioning external partners—what worked and what bogged you down?

Next Small Win — How Do We Start?

• What one small, irreversible step would make continuing this program inevitable?
• Which of these would you be willing to commit to as an initial step? Options: Approve a 60-day pilot SOW, Grant read-only access to one source, Designate an agency product owner, Allocate a small budget hold, Other
• What sprint cadence feels realistic for your team (and will leadership accept)? Options: Weekly demos, Biweekly sprints, Monthly milestones, Quarterly checkpoints
• Who is the escalation contact if a technical or security blocker jeopardizes the schedule? Options: CDO, CIO, CISO, Program Director, Other
• What is your expected decision timeline for moving from discovery to a funded engagement? Options: Immediate / within 2 weeks, Within a month, 1–2 months, Longer than 2 months, Unsure
• Is there anything else—political, technical, or cultural—that would help us design the right pilot or first step?